Skip to main content

Getting Started

Welcome to Security Hero RMF!

This guide walks you through everything from completing your AWS Marketplace subscription, to creating your admin account, connecting your AWS cloud environment, and viewing your first security report.

Before You Begin​

To use Security Hero RMF, you will need:

  • An AWS account (with admin privileges or IAM Role creation permissions)
  • Access to AWS Marketplace
  • The Account ID of the AWS account you want to analyze

During the AWS connection process, CloudFormation is used to create a dedicated IAM Role for Security Hero.

Step 0: Subscribe to Security Hero RMF​

Before you can start, you need to subscribe to the solution on AWS Marketplace.

  1. Go to the Marketplace: Use the link above to log in with your AWS account, then search for 'Security Hero RMF' and navigate to its product page.
AWS Marketplace subscription
  1. Subscribe: On the subscription page, review the product details, then click [Subscribe] to complete your subscription.
AWS Marketplace subscription step 2
AWS Marketplace Subscription

You are billed through AWS Marketplace according to the plan and quantity (number of projects) you choose. For plan details, see Subscription.

  1. Go to account setup: Once you have subscribed, AWS Marketplace shows a [Set up your account] button. Click it to open the Security Hero RMF account setup page.

Step 1: Create Your Admin Account​

You create the admin account in this order: the organization setup screen, the setup email, and the account setup screen.

1) Set up your organization​

On the "Set up your organization" screen opened by the [Set up your account] button in AWS Marketplace, enter your organization details.

  • Company Name: Your company or organization name (required)
  • Admin Email: The admin email address (required) Set up your organization screen in the subscription app

Click [Send setup link]. The page shows Check your email to finish setup and We sent the setup link to <your email>.

  • If the page shows Setup email not sent, your subscription was recorded but mail delivery failed. Contact support@securityhero.site.
  • If the page shows An account with this email already exists., that email is already registered in Security Hero RMF. Use a different admin email or contact support@securityhero.site.

2) Check the setup email​

An email with the subject "You've been invited to Security Hero RMF" is sent from noreply@securityhero.site to the admin email you entered. Click the [Set up your account] button in the email. Invitation email with the Set up your account button

  • The link is valid for 7 days.
  • If the email does not arrive, check your spam folder, then contact support.

3) Set up your account​

On the "Set up your account" screen of the organization portal, opened from the email link, create the admin account.

  • Email: Pre-filled from the invitation and cannot be changed.
  • Username: The ID you will use to log in
  • Password / Confirm password: Your login password and its confirmation Portal account setup (Set up your account) screen

Click [Create account]. The page shows Your account is ready and then moves to the sign-in page.

If the page says This invitation link is invalid or has expired., request a new setup link from the first screen using the same Company Name and Admin Email.

Password Policy

For strong security, passwords must meet all of the following requirements:

  • ✅ At least 8 characters
  • ✅ Contains uppercase letters
  • ✅ Contains lowercase letters
  • ✅ Contains numbers
  • ✅ Contains special characters
Company / Organization Name

The company (organization) name is entered on the first screen. After signing in, an admin can change it in the Organization card on the organization portal's Home page (see Organization Portal).

Step 2: First Login & Project Creation​

Sign-in screen After signing in with the username and password you created in Step 1, create a project and select a region as the unit of analysis.

  1. Log in: Sign in with the account you created in Step 1.
  2. Select project / region:
    • Enter a Project Name.
    • Select the Region where the assets you want to analyze are located.
  3. Enter the project: After creating the project, click the View Details button on the project card to enter it.

Create New Project dialog

Step 3: Connect Your AWS Account​

AWS Connection tab in Project Settings If the dashboard shows AWS Account Not Connected after entering your project, you need to connect an AWS account.

Resource Explorer Must Be Enabled

Before connecting your AWS account, you must first enable Resource Explorer in the AWS Console. Security Hero RMF relies on Resource Explorer to discover assets — synchronization will not work properly without it. For details, see Project Settings > Enable Resource Explorer.

  1. Enable Resource Explorer: In the AWS Console, navigate to the Resource Explorer service and click Turn on Resource Explorer to complete activation.
  2. Go to Project Settings: Click Go to Project Settings on the dashboard, or select Project Settings from the left sidebar menu.
  3. Prepare to connect: Click Connect AWS Account.
  4. Enter Account ID: Enter your AWS Account ID.
  5. Connect via CloudFormation: Create an IAM Role for Security Hero integration in your AWS Console.

    CloudFormation creates a read-only IAM Role that allows Security Hero to query your AWS asset information.

  6. Connection complete: Once the connection succeeds, your project is linked to your AWS account and all other features become available.

Step 4: Scan AWS Assets​

Asset synchronization screen After connecting your AWS account, you can scan assets from the Assets menu.

  1. Go to the Synchronization tab: Navigate to Assets > Synchronization.
  2. Select scan scope: Specify the services and resource types to scan using Resource Explorer.
  3. Run synchronization: Click Sync Now to start the scan.

    Depending on the size of your AWS account, synchronization may take anywhere from a few seconds to several minutes.

  4. Review results: View the details of scanned assets in Asset Inventory.

Step 5: Run a Risk Assessment on Scanned Assets​

Compliance Check screen Once the asset scan is complete, the security scanning engine (Prowler) evaluates each asset against AWS security best practices and compliance standards (such as NIST).

  1. Start a scan: Click New Scan on the Compliance Check page in the left menu.
  2. Run the assessment: Risk levels and security check results are analyzed based on the scanned assets.

    Depending on the size of your AWS account, a risk assessment may take 5 to 10 minutes.

  3. View detailed results: Once complete, click View Detailed Report to see the full results.

In the detailed results, you can review the following information per asset:

  • Risk level
  • Check results and compliance status (PASS/FAIL)
  • Control/NIST requirements for security improvement
Topology Feature

Security Hero RMF includes a Topology feature that visualizes the network structure and relationships between assets in your AWS environment as a graph.

The Topology feature consists of two graphs:

  • Network Graph – Network-centric asset relationship analysis
  • Asset Graph – Permission-centric asset relationship analysis

Step 6: View the Network Graph​

Network Graph screen The Network Graph visualizes network-related assets and their connection flows among your scanned assets.

  1. Explore the graph: Review the network topology centered on VPCs and Subnets.
  2. View asset details: See a full risk summary for each asset (when a risk assessment has been run), detailed asset and network information, and path analysis results.

Step 7: View the Asset Graph​

The Asset Graph visualizes relationships between AWS assets as a graph, including not just network assets but also IAM roles, policies, and other permission-related resources.

This lets you see at a glance who has what permissions over which assets in your AWS environment.

  1. Explore the graph: View relationships between various AWS assets such as IAM Roles, Users, and Policies.
  2. Analyze permission relationships: Understand the flow of permissions through the asset connections.
  3. Identify security insights: Detect security risks such as admin privileges, excessive permissions, and wildcard permissions.

Step 8: Review the Risk Assessment Report​

Report preview screen Once the risk assessment is complete, you can generate and download a report based on the results.

  1. Select a project and scan result.
  2. Choose the assets and assessment items to include in the report.
  3. Customize the cover title, description, and included sections to match your needs.
  4. Preview the report, then export it as PDF.

Next Steps​

To learn more about Security Hero RMF's key features, refer to the following documents: